Summary

totalStaked from userData is not tracked during staking

Vulnerability Details

The discrepancy between totalStaked and userData[msg.sender].totalStaked can lead to inaccurate tracking of staked tokens. When tokens are staked, totalStaked is incremented based on newStaked, but userData[msg.sender].totalStaked is not updated in the stake functions. If the epoch rolls over, and unstake functions are called later, the total amount subtracted from totalStaked and also from userData[msg.sender].totalStaked

This may cause issues because the value was never added during staking in the first place. This can result in incorrect reward calculations and inconsistencies in the contract’s balance.

Proof of Concept:

• User stakes tokens with the stake function, which increases newStaked and dr.staked but does not update userData[msg.sender].totalStaked.
  When the epoch rolls over, newStaked is added to totalStaked.

• User calls one of the unstake functions based on the type of unstake to unstake tokens. The total staked amount subtracted from userData[msg.sender].totalStaked may not match the amount recorded in userData[msg.sender].totalStaked because that was never updated during staking.

This mismatch affects the calculation of rewards and the contract balance.

Impact

totalStaked from userData is never tracked

Tools Used

manual review

Recommendations

Update userData[msg.sender].totalStaked in the staking functions to ensure consistency between individual user data and the contract's total staked balance.